Could Freezer Cyberattacks Threaten the UK’s Food Supply?

First came the melting ice cream. Then came the stench of rotting meat, followed by the desperate sight of supermarket workers shovelling spoiled food into black bin bags.

On Sunday, October 11, an unprecedented cyber attack struck refrigeration units in 700 French supermarkets. In the worst-hit stores, freezer temperatures soared to 80C — roughly the heat of a sauna — while small fires broke out after plastic and cardboard packaging caught alight.

Cooperative U was among the chains worst affected, with around 5 per cent of its 2,000 stores hit. Carrefour, Intermarche, Monoprix and Netto were also targeted. Food worth hundreds of millions of euros had to be thrown away.

The incident made headlines around the world. But it was only the opening act.

Just three weeks later, on Monday, a second cyber attack targeted refrigeration systems at about 100 stores across Europe, including outlets in Sweden, Belgium, Ireland, Finland, Luxembourg and the Netherlands. Chilled and frozen food worth tens of millions of euros was destroyed. In some cases, products had been stored at temperatures as low as minus 27C before the refrigeration units were heated to above 50C.

Christophe Hansen, the EU agriculture and food commissioner, called the second incident a “deliberate attempt to disrupt our food supply-chain”.

The attacks caused shortages and empty shelves in supermarkets across Europe. Fortunately, the refrigeration systems at the larger processing and storage facilities supplying those stores were not affected, meaning retailers should be able to replenish their shelves quickly.

Even so, the sudden shortages have intensified concerns about the resilience of food supply chains, particularly as European governments urge the public to prepare for emergencies. Last week, Defence Secretary Wes Streeting told people in Britain to keep enough supplies for 72 hours. Some countries have issued even tougher guidance: Sweden, for example, advises residents to remain self-sufficient for up to a week.

Although supermarket shelves have now largely returned to normal, the attacks were reportedly far less sophisticated than last week’s multi-billion-pound cryptocurrency heist, which is believed to have been orchestrated by North Korea. Vincent Strubel, head of France’s cyber security agency ANSSI, said they exploited “basic security flaws” in computer software. Such weaknesses are thought to be widespread in Britain and across Europe’s “operational technology” — everyday equipment, including refrigerators and fire alarms, that is connected to the internet but often receives little cyber-protection. Artificial intelligence has made it far faster and easier to identify these vulnerabilities.

No group has claimed responsibility, and no ransom demand has been made, seemingly ruling out conventional criminal gangs. If that is the case, the incidents raise the disturbing possibility that they represent an unprecedented example of state-sponsored “shadow warfare”.

In its annual “cyber security review”, published yesterday, the National Cyber Security Centre (NCSC), which is part of GCHQ, warned: “By 2028, it is highly likely China, Russia and other nation states will routinely use AI cyber to achieve their geopolitical goals, with the UK facing an increase in scale and speed of sophisticated cyber attacks.”

The NCSC has recorded at least 1,831 cyber attacks against British companies, organisations or infrastructure this year alone. Of those, 80 were considered to be of “national significance”.

It also emerged yesterday that Britain’s meat-processing industry is currently dealing with one such attack, with NCSC teams working through the night to warn affected companies about the crisis.

So what is known about the latest attacks — and could they mark the beginning of a sustained cyber campaign against Western Europe, including Britain? Like many modern systems, supermarket refrigeration units are connected to the internet, allowing them to be monitored and controlled remotely. A single technician can often oversee equipment across several stores at once.

Gaining entry may have been straightforward. Many of these systems are believed to have been protected by “default credentials” — preset passwords such as “admin” or “1234” that are included in instruction manuals freely available online.

“It’s a preconfigured password,” said Daniel Des Santos, vice president of research at cyber security firm Forescout. “It’s not a matter of guessing: they’re publicly available.”

After gaining access, the attackers were able to switch the units into “defrost” mode, sending temperatures rapidly upwards. They also appear to have blocked supermarket staff from controlling their own equipment. The manager of one affected store in southern Sweden said: “We can’t adjust the temperatures… Hot air is blowing into the freezers. Everything is ruined.”

Normal operations resumed only after the refrigeration systems were cut off from the digital network and switched to manual control.

CHECK THIS OUT: Are Julianne Hough and Bachelor Nation’s Tanner Courtad Dating?

‘People traditionally think about laptops and smartphones being connected to the internet,’ Dos Santos explains. ‘But there are numerous other devices also connected, including refrigeration systems, door locks, fire alarms, security cameras – the list goes on. And ever since the war in Ukraine, we have noticed an increase in attacks against these sorts of devices.’

It’s not difficult to see why refrigeration units were an appealing target. Empty supermarket shelves impact on the public directly and are a glaring sign of supply-chain vulnerability. But perhaps more importantly, these systems were low-hanging fruit: as explained, the security on the units was often exceptionally poor.

‘This attack was enabled by very poor security design, not high-end exploitation,’ James Lyne, CEO of leading cybersecurity organisation The SANS Institute told the Daily Mail. ‘It is frankly a little embarrassing.’

Why hadn’t the passwords been changed? Likely, explains Dos Santos, because the systems were built decades ago, often without proper communication between the supermarket security team and the installer.

As well as entering a default password to gain access to some systems ‘through the front door’, the hackers are believed to have identified vulnerabilities in computer code to access other systems.

Until the start of this year, finding such vulnerabilities in software was ‘very manual work’, says Dos Santos. His team would spend ‘hours, days and weeks’ reading source code and finding flaws. Today, AI can do these tasks automatically.

As Britain’s NCSC chief executive Richard Horne explained yesterday: ‘Vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.’ Britain’s cyber chief concluded that Britain had done ‘tech on the cheap’ for too long and that the country is increasingly vulnerable to AI-enabled cyber warfare.

As for who precisely might have been responsible, this remains unknown – although there are several suspects.

Gerome Billois, of cybersecurity and tech company Wavestone, says the attacks appeared ‘designed to convey the message to populations that they are not safe, to convey the impression that the government is falling apart, and ultimately to instil fear. Currently there are two international actors known for doing this sort of thing: Iran and Russia.’

But Ciaran Martin insists the mystery is only deepening: ‘For the first time since I started heading up what became the NSCS 13 years ago, there’s been a globally significant cybersecurity incident, and neither I nor anybody I know in the profession has a clue who’s behind it.’

One theory Martin does raise is that the hack could be an experiment ahead of further planned attacks. And when it comes to broader tech infrastructure across the UK, he is particularly concerned about healthcare.

‘The area that worries me most and most deserves national prioritisation is healthcare. Cyber attacks won’t necessarily cause the power to fail in the middle of an operation, but if hospital administration can’t process data properly, then hospitals will be forced to turn away ambulances. You cancel operations. You cancel diagnostic appointments.’

Indeed, in the summer of 2024 Russian hackers attacked a number of British hospitals including London’s King’s College and Guy’s and St Thomas’ which led to the cancellation of operations and emergency patients being diverted to other healthcare centres.

Martin adds that the most dangerous threat to any country – including the UK – is not some sort of ‘cyber spectacular’, for example taking out the entire national grid, but what the former head of the US Cyber Defence Agency Jen Easterly called: ‘everything, everywhere, all at once’.

Martin, who stepped down from NCSC in 2020, explains: ‘Hundreds of low-level disruptive attacks that would seriously mess up the economy and society. Think what happened last year in the UK with Marks and Spencer and Jaguar Land Rover [JLR], and then multiply that by 100.’

The Russian hack on JLR in August last year was widely acknowledged to be the most financially damaging in British history, costing just under £2billion and having a knock-on effect to 5,000 companies. The M&S hack in April last year led to empty shelves, a pause on online orders and the theft of customer data.

But the recent sabotage of European refrigeration systems was different – and in some ways more ominous. For unlike JLR and M&S, the refrigeration attacks were not for profit, but to sow chaos and disorder. The target was not public money, but the public itself.

Tomorrow it might not be the freezers but the train signals could fail, planes may lose direction in the sky, taps stop running, plug sockets lie dead, as a crisis happens everywhere, all at once.